# Escalate Auth Bypass

Turn a suspected or confirmed authentication/authorization bypass into impact, admin...

- Repository: https://github.com/vigolium/vigolium (1141 stars)
- Category: Engineering
- License: MIT
- Last updated: 2026-10-25
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add vigolium/vigolium --skill escalate-auth-bypass -g -a claude-code -y`
Codex: `npx skills add vigolium/vigolium --skill escalate-auth-bypass -g -a codex -y`
Cursor: `npx skills add vigolium/vigolium --skill escalate-auth-bypass -g -a cursor -y`
Gemini CLI: `npx skills add vigolium/vigolium --skill escalate-auth-bypass -g -a gemini-cli -y`

## Description

Turn a suspected or confirmed authentication/authorization bypass into impact, admin access, session takeover, privilege escalation, or cross-tenant read. Use when you find a missing auth check on a route, a weak JWT verifier, a session cookie that's predictable or reusable across users, a privilege field client-controllable, or an audit finding tagged CWE-287/CWE-863/CWE-639. Walks from probe to admin-equivalent capability and persists a finding with the highest-impact action you reached.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Auth Bypass → Impact Escalation

You have a suspected auth weakness. Your job is to turn it into the
strongest impact you can demonstrate, admin access, cross-tenant data
read, token forgery, or session takeover, and persist a finding with the
specific action that proves it. Reporting "missing auth check" without
showing what it gets you is not a finding.

## When this skill applies

- A route responds 200 with no `Authorization` / session cookie when it
  should require auth (compare to a known-auth'd record's response).
- JWT verification accepts `alg: none`, a key-confused HMAC secret, or a
  token signed with the public key as HMAC secret.
- A session ID is predictable (sequential, time-based, or short).
- A request body / query has a role/tenant/user field that, when changed,
  changes the response (`role=user` → `role=admin`, `tenant=A` → `tenant=B`).
- Audit harness flagged CWE-287, CWE-862, CWE-863, CWE-639, CWE-284, or
  CWE-639, even theoretical.

## Workflow

### 1. Establish baselines

Use `list_auth_sessions` to see which auth contexts already exist for the
host. Use `auth_session_lookup` to pull the actual headers for at least
two roles if you have them (`anon` + `user` is enough; `user` + `admin`
is ideal). `remember` the role boundaries as `auth-roles`.

If only one role is available, use `query_records` to find an
unauthenticated record for the same endpoint to anchor the no-auth
baseline.

### 2. Classify the weakness

Pick **one** mechanism to attack, don't shotgun:

The rest: https://github.com/vigolium/vigolium/blob/HEAD/internal/resources/olium/skills/escalate-auth-bypass/SKILL.md